SIMATIC CN 4100 CVE-2025-40938

Exploitation requires that the attacker first obtain a SIMATIC CN 4100 firmware image (any version < V4.0.1) and recover the hard-coded sensitive information (credentials/keys) stored within it - this firmware-analysis step is the primary limiting factor and is reflected in AC:H. Once the embedded secret is recovered, no per-target privileges or user interaction are needed (PR:N/UI:N), and because the credential is hard-coded in firmware it likely applies to all devices running the same version. Limiting factors: the attacker needs access to the firmware and the analysis capability to extract the secret; exploitation is constrained to the niche population of deployed CN 4100 devices below V4.0.1; fixed in V4.0.1.

CVSS 4.0 base score is 9.2 (Critical) with vector AV:N/AC:H/AT:N/PR:N/UI:N and full High confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H, no scope/subsequent-system change). The CWE-798 (Use of Hard-coded Credentials) classification and the 'Authentication Bypass' tag align with the description of sensitive information stored in firmware. However, the signals are in tension: the vector asserts a network attack vector with no privileges (AV:N/PR:N), yet extracting secrets embedded in firmware realistically requires first obtaining and analyzing a firmware image, which is reflected in the High attack complexity (AC:H) and is why the score is 9.2 rather than ~10. EPSS is low at 0.38% (30th percentile), indicating low modeled probability of near-term broad exploitation, and there is NO CISA KEV listing and NO public exploit identified. This is a credible high-severity issue for operators of this specific device, but the practical risk is tempered by AC:H and the absence of any observed exploitation - it is a 'patch on a planned OT maintenance window' priority rather than an emergency, widely-exploited internet threat. Note the inherent nature of hard-coded credentials: once the secret is recovered from any one device's firmware, it may apply across all devices of the same version, so the AC:H barrier is one-time per credential, not per target.

An attacker obtains a SIMATIC CN 4100 firmware image (versions < V4.0.1) and extracts hard-coded credentials or sensitive keys embedded within it. Those recovered secrets are then used to authenticate to or access the device over the network, bypassing normal authentication to read, modify, or disrupt device operation. No public exploit code has been identified at time of analysis, and the AC:H rating reflects the firmware-analysis effort required before network access succeeds.